CIS HAProxy 2.8 Benchmark

This recommendation verifies that HAProxy Runs Under a Dedicated User on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to hAProxy Runs Under a Dedicated User may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

ps -ef | grep haproxy
# Should run as 'haproxy' user, not root
grep -E '^(user|group)' /etc/haproxy/haproxy.cfg

# In /etc/haproxy/haproxy.cfg global section:
global
    user    haproxy
    group   haproxy

This recommendation verifies that HAProxy Is the Latest Stable Version on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to hAProxy Is the Latest Stable Version may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

haproxy -v
# Compare with https://www.haproxy.org/

# Update to latest 2.8.x patch:
dnf update haproxy   # RHEL/Rocky
apt upgrade haproxy  # Debian/Ubuntu

File and directory permissions for Configuration File should be set to Restrictive. Overly permissive access controls can allow unauthorized users to read, modify, or execute sensitive files, potentially compromising the HAProxy 2.8 load balancer.

Incorrect permissions on Configuration File could allow unauthorized reading, writing, or execution of critical files. Proper file permissions are a foundational control that prevents privilege escalation and data tampering.

stat -c '%a %U:%G' /etc/haproxy/haproxy.cfg
# Should be 640 root:haproxy or 600 root:root

chown root:haproxy /etc/haproxy/haproxy.cfg
chmod 640 /etc/haproxy/haproxy.cfg

This recommendation addresses the proper configuration of Chroot on the HAProxy 2.8 load balancer. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Chroot can lead to security gaps that may be exploited by attackers. A properly configured HAProxy 2.8 load balancer reduces exposure to both known vulnerabilities and configuration drift.

grep -i chroot /etc/haproxy/haproxy.cfg

# In /etc/haproxy/haproxy.cfg global section:
global
    chroot /var/lib/haproxy

This setting controls whether Daemon Mode is enabled on the HAProxy 2.8 load balancer. Enabling this feature strengthens the security posture by enforcing the recommended configuration via haproxy.cfg or HAProxy runtime API.

Without Daemon Mode enabled, the HAProxy 2.8 load balancer may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

grep -E '^[[:space:]]*daemon' /etc/haproxy/haproxy.cfg

# In /etc/haproxy/haproxy.cfg global section:
global
    daemon

This recommendation verifies that maxconn Is Set Appropriately on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to maxconn Is Set Appropriately may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep maxconn /etc/haproxy/haproxy.cfg

# Set global and per-frontend maxconn:
global
    maxconn 50000

frontend http-in
    maxconn 10000

This recommendation verifies that Minimum TLS Version Is 1.2 on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to minimum TLS Version Is 1.2 may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i ssl-min-ver /etc/haproxy/haproxy.cfg
# Or in bind line: ssl-min-ver TLSv1.2

# In global or bind directive:
global
    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets

# Or per-frontend:
bind *:443 ssl crt /etc/haproxy/certs/ ssl-min-ver TLSv1.2

This recommendation verifies that Strong Cipher Suites Are Used on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to strong Cipher Suites Are Used may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i ssl-default-bind-ciphers /etc/haproxy/haproxy.cfg

global
    ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305
    ssl-default-bind-ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256

This setting controls whether HSTS is enabled on the HAProxy 2.8 load balancer. Enabling this feature strengthens the security posture by enforcing the recommended configuration via haproxy.cfg or HAProxy runtime API.

Without HSTS enabled, the HAProxy 2.8 load balancer may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

grep -i 'Strict-Transport-Security' /etc/haproxy/haproxy.cfg

frontend https-in
    http-response set-header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

File and directory permissions for SSL Certificate File should be set to Restrictive. Overly permissive access controls can allow unauthorized users to read, modify, or execute sensitive files, potentially compromising the HAProxy 2.8 load balancer.

Incorrect permissions on SSL Certificate File could allow unauthorized reading, writing, or execution of critical files. Proper file permissions are a foundational control that prevents privilege escalation and data tampering.

stat -c '%a %U:%G' /etc/haproxy/certs/*.pem
# Should be 600 root:root or 640 root:haproxy

chown root:haproxy /etc/haproxy/certs/*.pem
chmod 640 /etc/haproxy/certs/*.pem

This setting controls whether OCSP Stapling is enabled on the HAProxy 2.8 load balancer. Enabling this feature strengthens the security posture by enforcing the recommended configuration via haproxy.cfg or HAProxy runtime API.

Without OCSP Stapling enabled, the HAProxy 2.8 load balancer may lack critical protections against known attack vectors. Enabling this control mitigates risk and aligns the deployment with industry-accepted security baselines.

grep -i 'ocsp-update' /etc/haproxy/haproxy.cfg

# In bind line:
bind *:443 ssl crt /etc/haproxy/certs/ ocsp-update on

This recommendation verifies that Management Interfaces Are Restricted by IP on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to management Interfaces Are Restricted by IP may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check stats/admin frontend for ACL restrictions:
grep -A5 'stats' /etc/haproxy/haproxy.cfg | grep -i 'acl\|http-request deny'

listen stats
    bind 127.0.0.1:8404
    stats enable
    stats uri /stats
    acl allowed_mgmt src 10.0.0.0/8 172.16.0.0/12
    http-request deny unless allowed_mgmt

This recommendation verifies that Default Backend Returns 403 on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to default Backend Returns 403 may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i 'default_backend' /etc/haproxy/haproxy.cfg

backend deny-all
    http-request deny deny_status 403

frontend http-in
    default_backend deny-all

This recommendation addresses the proper configuration of Connection Rate Limiting on the HAProxy 2.8 load balancer. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Connection Rate Limiting can lead to security gaps that may be exploited by attackers. A properly configured HAProxy 2.8 load balancer reduces exposure to both known vulnerabilities and configuration drift.

grep -i 'stick-table\|sc_conn_rate\|sc_http_req_rate' /etc/haproxy/haproxy.cfg

frontend http-in
    stick-table type ip size 100k expire 30s store conn_rate(10s),http_req_rate(10s)
    tcp-request connection track-sc0 src
    tcp-request connection reject if { sc_conn_rate(0) gt 100 }
    http-request deny deny_status 429 if { sc_http_req_rate(0) gt 200 }

This recommendation addresses the proper configuration of Slowloris Protection on the HAProxy 2.8 load balancer. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Slowloris Protection can lead to security gaps that may be exploited by attackers. A properly configured HAProxy 2.8 load balancer reduces exposure to both known vulnerabilities and configuration drift.

grep -i 'timeout http-request' /etc/haproxy/haproxy.cfg

defaults
    timeout http-request 10s
    timeout http-keep-alive 10s

This recommendation addresses the proper configuration of Logging on the HAProxy 2.8 load balancer. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Logging can lead to security gaps that may be exploited by attackers. A properly configured HAProxy 2.8 load balancer reduces exposure to both known vulnerabilities and configuration drift.

grep -i 'log' /etc/haproxy/haproxy.cfg | head -10

global
    log /dev/log local0
    log /dev/log local1 notice

defaults
    log global
    option httplog

This recommendation verifies that Custom Log Format Includes Client IP and Headers on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to custom Log Format Includes Client IP and Headers may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i 'log-format' /etc/haproxy/haproxy.cfg

defaults
    log-format "%ci:%cp [%tr] %ft %b/%s %TR/%Tw/%Tc/%Tr/%Ta %ST %B %CC %CS %tsc %ac/%fc/%bc/%sc/%rc %sq/%bq %hr %hs %{+Q}r"

This recommendation verifies that Stats Page Is Protected with Authentication on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to stats Page Is Protected with Authentication may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -A10 'stats enable' /etc/haproxy/haproxy.cfg | grep 'stats auth'

listen stats
    stats enable
    stats hide-version
    stats realm HAProxy\ Statistics
    stats auth admin:StrongP@ssw0rd!
    stats refresh 30s

This recommendation verifies that Stats Admin Mode Is Disabled in Production on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to stats Admin Mode Is Disabled in Production may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i 'stats admin' /etc/haproxy/haproxy.cfg
# Should not be present or should be restricted

# Remove or restrict stats admin:
# stats admin if LOCALHOST  ← only from localhost

This recommendation verifies that X-Frame-Options Is Set on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to x-Frame-Options Is Set may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i 'X-Frame-Options' /etc/haproxy/haproxy.cfg

frontend https-in
    http-response set-header X-Frame-Options "SAMEORIGIN"

This recommendation verifies that X-Content-Type-Options Is Set on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to x-Content-Type-Options Is Set may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i 'X-Content-Type-Options' /etc/haproxy/haproxy.cfg

frontend https-in
    http-response set-header X-Content-Type-Options "nosniff"

This recommendation verifies that Server Header Is Hidden on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to server Header Is Hidden may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

curl -sI https://example.com | grep -i server

frontend https-in
    http-response del-header Server
    http-response del-header X-Powered-By

This recommendation verifies that Suspicious HTTP Methods Are Blocked on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to suspicious HTTP Methods Are Blocked may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i 'method' /etc/haproxy/haproxy.cfg | grep -i 'acl\|deny'

frontend http-in
    acl valid_method method GET HEAD POST PUT DELETE PATCH OPTIONS
    http-request deny unless valid_method

This recommendation verifies that Large Request Headers Are Rejected on the HAProxy 2.8 load balancer. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to large Request Headers Are Rejected may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -i 'tune.maxrewrite\|tune.bufsize' /etc/haproxy/haproxy.cfg

global
    tune.bufsize 16384
    tune.maxrewrite 1024

This recommendation addresses the proper configuration of Backend Health Checks on the HAProxy 2.8 load balancer. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Backend Health Checks can lead to security gaps that may be exploited by attackers. A properly configured HAProxy 2.8 load balancer reduces exposure to both known vulnerabilities and configuration drift.

grep -i 'option httpchk\|check' /etc/haproxy/haproxy.cfg

backend app_servers
    option httpchk GET /health
    http-check expect status 200
    server app1 10.0.1.10:8080 check inter 5s fall 3 rise 2
    server app2 10.0.1.11:8080 check inter 5s fall 3 rise 2

This recommendation configures the timeout for All on the HAProxy 2.8 load balancer. Appropriate timeout values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to all Timeouts Are Explicitly Set may leave the HAProxy 2.8 load balancer vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

grep -E 'timeout (connect|client|server|http-request|http-keep-alive|queue)' /etc/haproxy/haproxy.cfg

defaults
    timeout connect 5s
    timeout client  30s
    timeout server  30s
    timeout http-request 10s
    timeout http-keep-alive 10s
    timeout queue 30s
    timeout tunnel 3600s

This setting ensures that Connection Retries is limited on the HAProxy 2.8 load balancer. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted Connection Retries could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the HAProxy 2.8 load balancer is essential for defense in depth.

grep -i 'retries' /etc/haproxy/haproxy.cfg

defaults
    retries 3
    option redispatch